Director, Security Risk Management

CardWorks Servicing LLC; United States; Hybrid; USD 151,165 - 167,961; Full time

Benefits offered by this job

Medical, Dental, and Vision coverage

401(k) Plan with Company Match

Paid vacation and sick days

Job summary

CardWorks Servicing LLC is looking for an Information Security Risk Management Director to lead the design, implementation, and oversight of security risk management programs. The role emphasizes cyber risk identification and assessment, ensuring centralized management within the risk framework.

Responsibilities include leading a team, conducting risk assessments, and collaborating with internal stakeholders. The ideal candidate will have over 8 years in information security, a strong grasp of risk frameworks, and proven leadership experience.

Qualifications

• 8+ years of experience in information security or related fields.
• 3+ years in a leadership or program management capacity.
• Strong understanding of information security risk frameworks.

Responsibilities

• Lead and operationalize information security risk management programs.
• Conduct vendor security reviews and assessments.
• Define and report cybersecurity risk metrics.

Skills

Information Security

Security Risk Management

Program Management

Analytical Skills

Communication Skills

Education

Bachelor’s or master’s degree in Information Security or related field

Tools

GRC platforms (e.g., Archer, ServiceNow, Auditboard)

Job description

Position Summary

The Information Security Risk Management Director leads the design, implementation, and oversight of the organization’s information security risk management and vendor security assessment programs. The role focuses on cyber risk identification, assessment, mitigation, and reporting, ensuring activities are centrally managed within the organization’s risk management framework and tools.

Responsibilities

Leadership and Program Oversight

• Lead, mature, and operationalize the information security risk management and vendor security assessment programs.
• Provide strategic and hands‑on guidance to a small team and/or third‑party resources executing assessments, managing risk registers, and maintaining program processes.
• Develop and maintain consistent methodologies, templates, and workflows for risk assessments and vendor reviews.
• Partner with Enterprise Risk Management to integrate cybersecurity risks into enterprise risk registers and escalation processes.

Risk Assessment and Governance

• Oversee and perform security risk assessments for applications, infrastructure, and business processes to identify threats, vulnerabilities, control weaknesses, and business impacts.
• Develop risk scoring methodologies to prioritize risks based on likelihood and business impact.
• Identify opportunities to streamline assessment workflows, automate evidence collection, and enhance tool integration across GRC, IT, and security systems.

Vendor and Third‑Party Security Risk Lead

• Conduct vendor security reviews, evaluating SOC2 reports, ISO27001 certifications, PCI AOCs, and penetration test results.
• Collaborate with Procurement, Legal, and Third‑Party Risk Management to embed security requirements into contracts, onboarding, and ongoing vendor oversight.
• Track and manage vendor‑related security issues, ensuring timely remediation, escalation, and closure consistent with SLAs and enterprise issue management processes.
• Develop and maintain vendor risk dashboards and KRIs to provide visibility into supply‑chain risk exposure and remediation progress.

Reporting and Continuous Improvement

• Define, track, and report cybersecurity risk metrics, dashboards, and assessment outcomes for senior leadership.
• Ensure data quality, consistency, evidence integrity, and traceability across GRC platforms and supporting tools.
• Drive program improvements through automation, analytics, risk trend analysis, and lessons learned from incidents, audits, and assessments.
• Promote a culture of transparency, accountability, and proactive cyber risk management throughout the organization.

Qualifications

• 8+ years of experience in information security, security risk management, compliance, or related fields within a regulated or technology‑driven environment.
• 3+ years in a leadership or program management capacity.
• Demonstrated experience in assessing, mitigating, and tracking security risks across systems, infrastructure, and third‑party vendors.
• Strong understanding of information security risk frameworks and methodologies, including the Cyber Risk Institute Profile, NIST Cybersecurity Framework, CIS‑CSC, and PCIDSS.
• Hands‑on experience applying these standards to projects, systems, and infrastructure.
• Experience developing or enhancing risk management processes and integrating governance workflows with enterprise risk management practices.
• Proven ability to collaborate with IT, Enterprise Risk Management, Legal, Compliance, business units, and external partners.
• Familiarity with GRC or security compliance platforms (e.g., Archer, ServiceNow, Auditboard).
• Bachelor’s or master’s degree in information security, information technology, risk management, or a related field is preferred.
• Preferred certifications: CRISC, CISM, CISSP, or CISA.

Summary of Qualifications

• Strategic and hands‑on cybersecurity risk leader with proven ability to design, implement, and mature enterprise‑wide risk management programs.
• Deep understanding of information security risk frameworks and enterprise risk management principles.
• Successful track record of leading and mentoring small teams and scaling risk management functions.
• Strong analytical, problem‑solving, and communication skills, capable of translating risks into business‑relevant insights.
• Committed to continuous improvement, accountability, operational excellence, and a culture of proactive security risk management.

Location & Work Model

• Preferred locations: Woodbury,NY; SouthJordan,UT; Horsham,PA; Pittsburgh,PA; Orlando,FL.
• Hybrid or fully remote work model may be considered based on hiring manager decision and role priorities.

Compensation

Salary range for this position, if located in NY Metro/NY State: $151,165 to $167,961. The range may vary for other geographic areas.

Benefits

• Medical, Dental, and Vision coverage
• 401(k) Plan with Company Match
• Short‑ and long‑term disability insurance
• Wellness programs
• Group life and AD&D insurance
• Paid vacation, sick days, and bank holidays
• Employee engagement activities and appreciation days
• DEI initiatives and employee resource groups
• Corporate social responsibility and service recognition programs

Equal Opportunity Employer

We are proud to be an equal opportunity employer. All qualified applicants will receive consideration without regard to age, race, color, sex, gender identity, sexual orientation, religion, creed, ancestry, citizenship, national origin, disability, military or veteran status, marital status, genetic information, or any other characteristic protected by applicable law. We do not tolerate discrimination, harassment, or retaliation.

Reasonable Accommodation

Applicants who need assistance or a reasonable accommodation during the application or hiring process should contact the TA Partner.